What is reported
Reports on 28 October 2026 say India is considering a new AI law that could create a separate safety framework for the most powerful AI models, requiring developers to show adequate safeguards before public release2. Options reportedly under discussion include pre-release evaluation, testing in controlled environments and sandbox requirements, with a consultation paper expected soon1. Earlier in October, the IT Minister was reported as saying a regulation blueprint would follow within a month4, and coverage has also described proposals for safeguards on high-risk AI systems3. None of this is final.
Who it could affect
Frontier rules target the companies that build the most capable models. Most organisations in India build applications on top of models: they choose a model, add tools and data, and ship an agent or feature. That layering matters, because obligations tend to follow the layer you control.
What to prepare now
Whatever the final shape, the evidence regulators ask for tends to be the same: what AI you run, how you tested it, how you watch it in production, and how people can challenge it. Building that evidence is useful whether or not the law passes.
- InventoryEvery AI system, the model behind it and its owner
- ClassifyWhich uses could be high-risk: credit, hiring, health, identity
- TestEvaluation sets and red-teaming before each release
- MonitorProduction tracing, incidents and drift
- LabelDisclose AI-generated content and guard against impersonation
- EngageRead the consultation and respond with your evidence
| Area | Status | Action now |
|---|---|---|
| Frontier model safety framework | Under consideration12 | Track the consultation; check your model providers' testing evidence |
| Deepfakes, fraud and impersonation | Expected in consultation1 | Content labelling, identity checks and abuse monitoring |
| DPDP Rules | Notified November 2025, phasing in over 18 months5 | Consent, retention and breach handling, including for AI uses |
Do not wait for the final text to build an AI inventory and evaluation evidence. Those are the first things any version of the law will ask for.
CTO take
For most companies in India this is a watch-and-prepare item, not a fire drill. The firm deadline is the DPDP Rules, so put effort there first, and make sure AI uses are inside that programme rather than beside it. In parallel, build the inventory, evaluation and monitoring that any AI regime will expect, and ask your model providers what testing evidence they can share. Global teams will recognise the pattern from the EU AI Act and Korea's AI Basic Act. Related: a DPDP-ready consent platform, evaluation sets that predict production and tech news for 29 October.
How I can help
I am based in India, the United States and the UAE, and help teams build AI governance that satisfies regulators without slowing delivery. See fractional CTO in India, or analyse your challenge and bring the result to a call.
- 1
- 2India considers new law to rein in AI risksNewsBytes · 28 Oct 2026
- 3India proposes US-inspired rules requiring safeguards for high-risk AI systemsNewsBytes · Oct 2026
- 4
- 5India's Digital Personal Data Protection Act, 2023 brought into forceHogan Lovells · Nov 2025
- 6AI Agent Observability: evolving standards and best practicesOpenTelemetry blog (Guangya Liu, Sujay Solomon) · 6 Mar 2025